| Author |
Message |
![[Post New]](/Sysforums/templates/default/images/icon_minipost_new.gif) 01/06/2010 06:22:29
|
Joseph Zargari
VP Customer Relations
Joined: 26/03/2006
Messages: 516
Offline
|
Hey Lev,
Basically, we never looked at this as a security issue. Since SysAid usually runs on a server, the serverConf.xml file should not be accessible for domain users to see (limited by NTFS permissions).
The password showing on the configuration file was more of a cosmetic issue.
Jospeh.
|
|
|
05/03/2013 20:34:17
|
@@@
SysAider
Joined: 08/01/2013
Messages: 2
Offline
|
I hate to dig up an old ticket but the responses to peoples questions in this thread are inadequate.
We are being told to use a service account with read-only privileges, however for password services you ask that we use a domain administrator account. what is the correct answer? Domain admin or read-only user?
|
|
|
07/03/2013 10:42:11
|
Joseph Zargari
VP Customer Relations
Joined: 26/03/2006
Messages: 516
Offline
|
Hi @@@,
SysAid requires read-only permissions to import user data from AD and perform authentication. It requires a domain admin account if you are also implementing Password Services.
I hope this answers your question.
Joseph.
|
|
|
14/05/2013 12:32:23
|
Tarphon
SysAider
Joined: 20/06/2008
Messages: 16
Offline
|
So did you ever notify your customers or do they only find out when they stumble across this post? Storing any password in plaintext is poor security and if you didn’t think this was an issue or worth notifying your clients about then what other “non-issues” are lurking out there for us to find?
Unacceptable.
|
|
|
18/05/2013 19:47:12
|
Joseph Zargari
VP Customer Relations
Joined: 26/03/2006
Messages: 516
Offline
|
Hi Tarphon,
Since this post started, this was already corrected. SysAid doesn't store any password in plain text in the config files, definitely not the domain admin's one.
We take security very seriously when we come to plan, design and develop our products. We spend great deal of efforts and resources making SysAid more secure.
Surely, things can go wrong - but we are always ready to respond quickly when a security breach is found.
Thanks,
Joseph.
|
|
|
![[Up]](/Sysforums/templates/default/images/icon_up.gif){kind=icon}
